Privacy Policy

3.1. Registration Data

• Email address
• First name and last name
• Password (stored only as a cryptographic hash — never in plain text)

3.2. OAuth Login Data (Google / Apple)

• Email address verified by the provider
• Name from the provider profile
• Encrypted access token (sodium_crypto_secretbox encryption)

3.3. Contact Form Data

• Sender's name
• Sender's email address
• Phone number (optional)
• Message content
• File attachments uploaded by the sender

3.4. QR Sticker Data

• 20-character sticker code and the technical QR token used in its public URL
• Scan data: timestamp, scan counter and short-lived technical identifiers used for abuse limits and duplicate notification suppression

3.5. Payment Data

• Transaction data (amount, date, status) stored on our side
• Card and bank account data is processed exclusively by Stripe Inc. and PayNow (mBank S.A.) — we do not store it on our servers

3.6. Shipping Address Data

• Recipient's full name
• Delivery address (street, postcode, city, country)
• Contact phone number (for the courier)

3.7. Technical Data

• User sessions (session cookies)
• A random app-installation identifier (UUID) and its pseudonymised HMAC digest, used only for manual security analysis of whether the same installation appeared on multiple accounts; we do not collect hardware identifiers for this purpose or make automated decisions
• Passkey data: public credential identifier and key, AAGUID, transports, counter, synchronization flags and creation/use dates; we never receive the private key or biometric data
• IP hashes for rate limiting — no raw IP addresses
• Error logs (Sentry) — technical error data, pseudonymised identifiers and minimal diagnostic context
• Web push VAPID endpoint; for mobile push: FCM token, Firebase Installation ID where supplied by the SDK, app installation/session identifier, platform, device model/name, OS and app versions, app language and notification-category preferences
• Owner data voluntarily made public for a sticker: sticker name, owner message and up to three labelled phone numbers
• Referral codes: 8-character code linked to the user's account
• Cloudflare Turnstile anti-spam data: verification token, IP address sent to the CAPTCHA provider and verification result

3.8. Browser Fingerprint

To protect the contact form against spam and group correspondence from the same browser, we generate a cryptographic hash on the client side from the following browser signals:

• Canvas rendering hash (rendering engine signature)
• WebGL renderer name
• Navigator data (user agent, platform, language, hardware concurrency)
• Screen resolution and colour depth
• Timezone offset

These signals are combined and immediately hashed — we store only the resulting hash, never the raw data. This hash is used for message rate limiting, spam blocking and assigning subsequent messages from the same browser to one conversation history. It is not used for advertising or marketing analytics.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest of the controller (protecting the service from abuse).

3.9. Location Data (GPS) in Lost Mode

When an Owner activates Lost Mode for a sticker, visitors to the item's public page can voluntarily share their GPS location. Before the browser's location prompt appears, a preliminary consent modal is displayed to ensure informed consent.

• We store latitude, longitude and optional accuracy with a GPS message, show them to the Owner in the app/dashboard and may send a map link by email. They are deleted from the active database no later than 30 days after sharing.
• Protected disaster-recovery backups may temporarily contain the record and are rotated within no more than 30 days; retention rules are reapplied after a restore.
• Sharing location data is entirely voluntary, and the user must actively choose to do so after reviewing the consent modal.
• To prevent abuse, a rate limit applies: a maximum of 3 location shares per IP address per sticker within a 24-hour period.

Legal basis: Art. 6(1)(a) GDPR — explicit consent. The individual sharing their location is the data subject; the sticker Owner receives the data acting as an independent data controller for the sole purpose of recovering the lost item.

3.10. Withdrawal and Return Process Data

When you submit a withdrawal request through the customer dashboard form or by email, we process:

• Order number
• Reason for withdrawal (category + optional text comment, max. 1000 characters)
• Date of request submission
• Return address (if different from the delivery address)
• Return parcel tracking number (optional)
• Administrator decision (acceptance/rejection) and its justification
• Information on any refund reduction (Art. 34(4) of the Polish Consumer Rights Act — Polish law) and its justification

Legal basis: Art. 6(1)(c) GDPR — legal obligation (Polish Consumer Rights Act of 30 May 2014) and Art. 6(1)(b) GDPR — performance of a contract.

Retention period: 6 years from the end of the calendar year in which the credit note was issued (Polish tax law: Art. 86 § 1 Ordynacja podatkowa and Art. 74 Accounting Act — tax and accounting requirements).

Recipients: data may be shared with payment operator PayNow (mBank S.A.) to the extent necessary to process the refund. Withdrawal form data is not shared with third parties for other purposes.

Scope and purpose

The administrator may review message content and attachments solely for the following purposes:

• moderation of unlawful content, threats, harassment or other abuses reported by users or detected by automated systems;
• investigation of abuse reports and maintaining platform safety;
• compliance with lawful requests from public authorities (Art. 6(1)(c) GDPR — legal obligation);
• establishment, exercise or defence of legal claims.

Legal basis

Processing for the above purposes is based on Art. 6(1)(f) GDPR — the legitimate interest of the controller in maintaining a safe platform and preventing misuse. A Legitimate Interest Assessment (LIA) has been carried out prior to implementing this policy. The results of the LIA are available on request at [email protected].

Safeguards

• Every administrator access to a message or attachment is recorded in an audit log (who, when, which message was accessed).
• Access is restricted to administrator accounts authenticated with a separate password (ROLE_ADMIN).
• Messages and attachments are automatically deleted 30 days after the date of submission, unless longer retention is necessary for an open legal case.
• Audit logs are reviewed periodically to ensure proportionality of access.

Right to object (Art. 21 GDPR)

The sender of a contact form message or the sticker owner may object to the processing of their data based on the controller's legitimate interest. The controller will assess the validity of the objection and respond within the statutory period. Objections may be submitted in writing to: [email protected].

9.1. Strictly Necessary Cookies (no consent required)

9.2. Functional Cookies (with consent)